CVE-2026-94373
Deferred Deferred - Pending Action

DOM-based XSS in MISP Contextual Menu Component

Publication date: 2026-09-21

Last updated on: 2026-09-21

Assigner: CIRCL

Description
MISP contains a DOM-based cross-site scripting (XSS) vulnerability in the contextual menu JavaScript component. The ContextualMenu class populates HTML <option> elements by assigning user-controllable values to the innerHTML property. Because innerHTML parses and renders HTML markup, any untrusted string supplied as the option text (value.text or value) is interpreted as live DOM content rather than plain text. An attacker who can influence the data rendered in the contextual menu can inject arbitrary HTML or JavaScript that executes in the victim's browser within the MISP application origin. This may allow session hijacking, data exfiltration, or unauthorized actions performed on behalf of the authenticated user. Version affected: <2.5.47

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-21
Last Modified
2026-09-21
Generated
2026-09-21
AI Q&A
2026-09-21
EPSS Evaluated
N/A
NVD
CVE-2026-94373
EUVD
EUVD-2026-83903

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
misp misp to 2.5.47 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

MISP has a DOM-based cross-site scripting (XSS) vulnerability in its contextual menu JavaScript component. The issue occurs because the ContextualMenu class uses the innerHTML property to populate HTML option elements with user-controllable values. Since innerHTML renders content as HTML, any untrusted input can be interpreted as executable code, allowing attackers to inject malicious scripts.

Detection Guidance

To detect this vulnerability, inspect the MISP application version. If it is less than 2.5.47, the system is vulnerable. Check the contextual_menu.js file for use of innerHTML with user-controlled data.

Impact Analysis

This vulnerability allows attackers to inject arbitrary HTML or JavaScript into the MISP application running in a victim's browser. Potential impacts include session hijacking, theft of sensitive data, or unauthorized actions performed on behalf of the authenticated user.

Compliance Impact

This DOM-based XSS vulnerability could lead to unauthorized data access or modification, which may violate GDPR's data protection requirements or HIPAA's security rules for handling sensitive information. The ability to inject malicious scripts could result in data breaches, unauthorized data exfiltration, or session hijacking, all of which are compliance violations under these regulations.

Mitigation Strategies

Upgrade MISP to version 2.5.47 or later. Apply the patch from the commit that replaces innerHTML with textContent in contextual_menu.js to prevent XSS attacks.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-94373. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart